CVE-2026-89637: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF and buffer leak in cifschecktrans2() for malformed secondary T2
When a valid primary TRANSACT2 response has been received (mid->respbuf set, mid->multiRsp true) and a subsequent secondary response causes cifschecktrans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handlemid() overwrites mid->respbuf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->respbuf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free.
Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeuemid() with malformed=true, and return true so handlemid() exits without touching mid->respbuf or the server buffer pointers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cifs_check_trans2(), combine both early-exit conditions; when mid->multiRsp is already set, abort the pending transaction inline by setting multiEnd, calling dequeue_mid() with malformed=true, and returning true so handle_mid() exits without modifying mid->resp_buf or the server->smallbuf/server->bigbuf pointers.
Event History
Frequently Asked Questions
What response sequence is required to trigger the flaw?
The client must first receive a valid primary TRANSACT2 response that sets both mid->resp_buf and mid->multiRsp. A later secondary response must then have an invalid SMB header or be rejected by check2ndT2().
Which systems are exposed?
Linux systems acting as SMB clients are affected when processing this multi-response TRANSACT2 exchange. The malformed secondary response is processed by the client-side CIFS/SMB handling path.
Are fixed kernel versions identified?
No fixed version numbers are provided. The available references identify three stable-kernel commits containing the resolution.